// uid contains the uid of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +optional
  optional string uid = 3;

  // groups contains group membership of the user that created the CertificateSigningRequest.
  // Populated by the API server on creation and immutable.
  // +listType=atomic
  // +optional
  repeated string groups = 4;

  // to the container's primary GID, the fsGroup (if specified), and group memberships
  // defined in the container image for the uid of the container process. If unspecified,
  // no additional groups are added to any container. Note that group memberships
  // defined in the container image for the uid of the container process are still effective,